Vulnerability · Published Jun 3, 2023 · Assigned by Wordfence
CVE-2023-2415Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout
Medium 5.4
In plain English
A medium-severity missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita from vcita. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vcita | Online Booking & Scheduling Calendar for WordPress by vcita | 0 – through 4.2.10 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/731cbeed-d4aa-448f-878a-8c51a3da4e18?source=cve
- https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55
- https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924763%40meeting-scheduler-by-vcita&new=2924763%40meeting-scheduler-by-vcita&sfp_email=&sfph_mail=